Vulnerability Prioritization Calculator

Combine CVSS, EPSS, KEV status, exposure and business criticality into one ranked order, with a formula you can see and adjust rather than a black box.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

1. Vulnerabilities

Enter each finding, or import the JSON export from CVE Search or a CSV with matching column names. Leave a field blank if you do not know it; unknowns are handled by the policy below and always listed.

2. The formula

score = controls multiplier × Σ(weight × factor) / Σ(weight) × 100. Every factor is mapped to 0-1 by the rule beside it.

Unknown inputs

Raise anything in CISA KEV to at least the top band

Compensating-control multipliers

Partial Strong

Bands (minimum score and target)

Why one number is not enough, and why a hidden one is worse

CVSS measures how bad a vulnerability could be. It does not say how likely exploitation is, whether the affected system is reachable, or whether anything valuable sits behind it. EPSS adds likelihood, KEV adds observed exploitation, and only you know your exposure and your assets. Prioritisation means combining these. Many products do that behind an unexplained "risk score" that you cannot audit or defend. This calculator does it with a formula you can read, adjust and export next to its results.

How each input moves the result

Each factor is scaled to between 0 and 1 by a fixed rule shown beside its weight. For example, CVSS divides by 10, and internet exposure counts as 1 while an isolated network counts as 0. The score is the weighted average of the factors, times 100. Compensating controls, such as a WAF rule or disabling the vulnerable feature, then multiply the result down. Every result lists each factor's contribution in points, so you can explain why a finding is P1 and what would change that.

Unknowns are not zeros

Leaving EPSS blank because you have not looked it up must not make a vulnerability look safer. By default an unknown input counts as the worst case, and it is named in the result. You can instead leave unknowns out of the calculation, which scores only on what you know. Both modes list exactly what was missing.

The KEV floor

A vulnerability CISA has confirmed as exploited in the wild should not sit in a low band because its CVSS is modest. The optional KEV floor raises such findings to the top band's minimum. The override is shown as a separate line, not folded into the arithmetic.

Tailor it, then write it down

The default weights are a starting point, not a standard. Adjust them to your environment, export the configuration with the results, and your prioritisation becomes reproducible: the same inputs always give the same order. For a structured, decision-tree alternative, see the SSVC Decision Calculator.

Frequently asked questions

Does this look anything up?

No. Everything is calculated in your browser from what you enter or import. Use CVE Search, EPSS Lookup and KEV Lookup to gather the public signals, then import the export here.

Why EPSS percentile rather than probability?

Most EPSS probabilities are tiny, so the raw number barely moves a weighted average. The percentile spreads CVEs across the 0-1 range. If you only have the probability it is used as given, and the result says so.

Is the result a risk rating?

It is an ordering aid. It is only as good as the inputs and weights, and a person should review the top of the list before committing resources.

References

FIRST CVSS and FIRST EPSS
CISA KEV catalogue

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.